Skip to main content
// FILE 05 · LOTOR

LOTOR

PRIVATE BETA

A record the vendor does not hold.

A signed, tamper-evident log of what your agent did during a session. What ran, what it touched, what it sent, what it cost, what failed. It lives on your machine, in a format you can inspect, verify, and archive.

// THE ARGUMENT

A company cannot audit itself

Every accountability story hits the same wall. The party that produced the record cannot also be the only one who keeps it and checks it. That is not an audit. That is a company grading its own homework.

Trust used to be the default, because checking was expensive. That assumption is expiring in public, one incident at a time. What replaces it is not more faith in the vendor. It is a record the vendor does not hold.

So the receipt is written local first, to your machine, under your key. The party with the real stake in the record's integrity is the party that keeps it. Local first is not a deployment checkbox here. It is the whole point.

// THE RECEIPT

What it records

  • •  Which tools ran, in order
  • •  What was sent, and where
  • •  What it cost, in tokens
  • •  What failed, surfaced not buried
  • •  Which model actually executed
{
  "seq": 19,
  "prevHash": "3f9c...",
  "session": {
    "model": "minimax-m3",
    "endedAt": "2026-07-22T22:16:21Z"
  },
  "ran": 18,
  "sent": 0
}
// KNOWN LIMITS

Honesty about limits is a feature

Anything that claims to be evidence should tell you where it stops being evidence. These are the ones that matter most.

SELF-ATTESTED CAPTURE

Tamper-evidence begins at signing time. The log proves that what was recorded has not been altered since. It does not prove the recorded events were complete, accurate, or truthful at the moment of capture. A clean receipt and a missed event look the same.

NO EXTERNAL ANCHORING YET

The chain is local only. There is no timestamp authority, no notary, no third party attesting that the record existed when it says it did. Tamper detection rests on local key custody and offsite export.

THE GATE MATCHES PATTERNS

Gated actions are matched on tool name and parameters. That is built for an honest agent going off script, not for an adversary engineering around the matcher. Treat it as a seatbelt, not a vault door.

The front half of reliability is predicting what an action will do. The back half is stating what it did. Only one of those is something you can hold in your hand today.

SEE THE PROTOCOL UNDERNEATH
Here is what changed. I stopped thinking of the prompt as a wall and started hearing it for what it actually is, which is a doorbell with no door behind it. It rings on everything. It rings the same way for a directory listing and for a command that...There is a room under every life now. A low hum of everything you have ever written down, every contact, every decision with its reasons still attached, sitting in one place and vibrating at a frequency only you are supposed to hear. The industry...There is a frequency beneath every system that most people never hear. A low, humming truth that sits under the noise and the polish and the architecture diagrams. You only notice it when the pressure rises. When the cables buzz. When the whole...An autonomous software agent is a program that takes a goal, makes a plan, calls tools, and produces an output. Many such agents exist. They are built by different teams, on different runtimes, with different model backends, and they live in...Every protocol has to answer the same first question: how do you know it's the real one? AIP answers that question with itself. The protocol I built is the system I used to build the protocol. Each piece of proof I produce is itself a build event....